fix: RSS feeds show stale data for rebuilt packages

[ryanpetrello]

Summary

• Use Max() instead of Min() for the added_at timestamp aggregation so feeds reflect the most recently added file for each (name, version) pair
• Append a #timestamp fragment to the <guid> so RSS readers treat rebuilds as new items, and set isPermaLink="false" accordingly
• Raise UPDATES_LIMIT from 100 to 500 for indexes with large batch promotions

Context

When a package is rebuilt with a different PEP 427 build tag (e.g., pkg-1.0-1-...whl then pkg-1.0-2-...whl), the RSS feed continued to show the original timestamp and guid because iter_releases() used Min("file_added_at"). RSS readers never surfaced the rebuild as a new item because the <guid> was unchanged.

The 100-entry limit in updates.xml was also too small for indexes that receive batch promotions of 100+ packages at once (we've seen promotions of up to 117 packages in a single hour).

Fixes #1374

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 48c7adbd-0fb6-49fc-b792-e907c8347f83

📥 Commits

Reviewing files that changed from the base of the PR and between 2653a46 and 8454d3d.

📒 Files selected for processing (3)

• CHANGES/1374.bugfix
• pulp_python/app/pypi/feeds.py
• pulp_python/tests/functional/api/test_pypi_feeds.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

RSS feeds now use the most recent file timestamp for releases and projects. Feed identifiers include publication timestamps, update limits increase to 500, and functional tests cover rebuilt package versions.

Changes

RSS feed fixes

Layer / File(s)	Summary
Feed freshness, identity, and limits pulp_python/app/pypi/feeds.py	Release and project feeds use the latest file_added_at value. Item identifiers include the publication timestamp and are no longer treated as permalinks. UPDATES_LIMIT increases to 500.
Rebuild coverage and release notes pulp_python/tests/functional/api/test_pypi_feeds.py, CHANGES/1374.bugfix	Functional tests verify new identifiers and publication dates when files are added to an existing version. The changelog records the RSS fixes.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 8454d

RSS feeds now surface rebuilt packages using their latest file timestamp, publish update-specific non-permalink GUIDs, and return up to 500 updates. The changed behavior is covered for rebuilds, with no concrete current-head merge risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes satisfy issue #1374: feeds use the latest file timestamp, rebuilt packages receive new GUIDs with non-permalink behavior, and UPDATES_LIMIT increases from 100 to 500.
Out of Scope Changes check	✅ Passed	The changelog, feed updates, and regression tests directly support the linked issue objectives. No unrelated code changes are identified.
Docstring Coverage	✅ Passed	Docstring coverage is 83.33% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files. (1 skipped: 1 u…
Title check	✅ Passed	The title clearly identifies the primary change: fixing stale RSS feed data for rebuilt packages.
Description check	✅ Passed	The description explains the changes, the root cause, the affected behavior, the increased limit, and the linked issue. It does not reproduce the repository checklist, but the required change and test…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gerrod3]

LGTM

[patchback]

Backport to 3.36: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.36/a47e20f9c93db0f4ac24e52119ceee8c955104b5/pr-1375

Backported as #1377

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.